Analysis
- max time kernel
15s - max time network
134s - platform
windows10_x64 - resource
win10-en - submitted
05/09/2021, 10:21
Static task
static1
Behavioral task
behavioral1
Sample
deddab103a2aaae2ce26b6b3b1b1d263ac4c272584ec1.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
deddab103a2aaae2ce26b6b3b1b1d263ac4c272584ec1.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
- Target deddab103a2aaae2ce26b6b3b1b1d263ac4c272584ec1.exe
- Size 517KB
- Sample210905-mdncjahec8
- SHA256 deddab103a2aaae2ce26b6b3b1b1d263ac4c272584ec1d7d5ff8a96bcbaebd4f
- MD5 cb2be9b44b5ccb320e6e6eabfbe3123f
- SHA1 85a92fb7d922a4d2c51bac03fedc2868599f23b5
- SHA512 e6a7ce063641002ac5315eecb2b11f0f4682d8144a81c26c49132c5a4dae2bd2e11ca83ef8a3ea6a8861097487b77c7fc8a60192686c2b79324eb6f8f624b0f9
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
56be4efb71b0a38de783d05b401b05f1bc805bb2
Attributes
-
url4cnc
https://telete.in/forkmaster123
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1944 created 4000 1944 WerFault.exe 68 - Program crash 5 IoCs
pid pid_target Process procid_target 2968 4000 WerFault.exe 68 3324 4000 WerFault.exe 68 4088 4000 WerFault.exe 68 4076 4000 WerFault.exe 68 1944 4000 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2968 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 3324 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 1944 WerFault.exe 1944 WerFault.exe 1944 WerFault.exe 1944 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2968 WerFault.exe Token: SeBackupPrivilege 2968 WerFault.exe Token: SeDebugPrivilege 2968 WerFault.exe Token: SeDebugPrivilege 3324 WerFault.exe Token: SeDebugPrivilege 4088 WerFault.exe Token: SeDebugPrivilege 4076 WerFault.exe Token: SeDebugPrivilege 1944 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\deddab103a2aaae2ce26b6b3b1b1d263ac4c272584ec1.exe"C:\Users\Admin\AppData\Local\Temp\deddab103a2aaae2ce26b6b3b1b1d263ac4c272584ec1.exe"1⤵PID:4000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 7682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 7722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 8282⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944
-